Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-20884: LibRaw: Malicious file can cause program to crash or run malicious code
CVE-2026-20884 · published 5 months ago
Summary
LibRaw, a library used to read raw image files, has a bug that can be exploited by a malicious file. This could cause a program using LibRaw to crash or run unauthorized code. Update to the latest version of LibRaw to fix this issue.
What to do
- Update debian rootio-libraw to version 0.21.4-2.root.io.2.
- Update debian rootio-libraw to version 0.21.4-2.root.io.3.
- Update debian libraw to version 0.21.4-2.root.io.3.
- Update canonical libraw to version 0.20.2-2ubuntu2.22.04.3.
- Update canonical libraw to version 0.21.2-2.1ubuntu0.24.04.2.
- Update canonical libraw to version 0.21.5b-1ubuntu1.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:Pro:16.04:LTS | canonical | libraw | All versions |
| Ubuntu:16.04:LTS | canonical | darktable | All versions |
| Ubuntu:16.04:LTS | canonical | dcraw | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | digikam | All versions |
| Ubuntu:16.04:LTS | canonical | exactimage | All versions |
| Ubuntu:16.04:LTS | canonical | kodi | All versions |
| Ubuntu:16.04:LTS | canonical | rawtherapee | All versions |
| Ubuntu:24.04:LTS | canonical | digikam | All versions |
| Ubuntu:24.04:LTS | canonical | exactimage | All versions |
| Ubuntu:24.04:LTS | canonical | kodi | All versions |
| Ubuntu:24.04:LTS | canonical | libraw |
< 0.21.2-2.1ubuntu0.24.04.2 Fix: upgrade to 0.21.2-2.1ubuntu0.24.04.2
|
| Ubuntu:24.04:LTS | canonical | rawtherapee | All versions |
| Ubuntu:25.10 | canonical | darktable | All versions |
| Ubuntu:25.10 | canonical | dcraw | All versions |
| Ubuntu:25.10 | canonical | digikam | All versions |
| Ubuntu:25.10 | canonical | exactimage | All versions |
| Ubuntu:25.10 | canonical | kodi | All versions |
| Ubuntu:25.10 | canonical | libraw | All versions |
| Ubuntu:25.10 | canonical | rawtherapee | All versions |
| Ubuntu:26.04:LTS | canonical | darktable | All versions |
| Ubuntu:26.04:LTS | canonical | dcraw | All versions |
| Ubuntu:26.04:LTS | canonical | digikam | All versions |
| Ubuntu:26.04:LTS | canonical | exactimage | All versions |
| Ubuntu:26.04:LTS | canonical | kodi | All versions |
| Ubuntu:26.04:LTS | canonical | libraw |
< 0.21.5b-1ubuntu1.1 Fix: upgrade to 0.21.5b-1ubuntu1.1
|
| Ubuntu:26.04:LTS | canonical | rawtherapee | All versions |
| Debian:11 | debian | libraw | All versions |
| Debian:12 | debian | libraw | All versions |
| Debian:13 | debian | libraw | All versions |
| Debian:14 | debian | libraw | All versions |
| – | libraw | libraw |
0.22.1 cpe:2.3:a:libraw:libraw:0.22.1:*:*:*:*:*:*:* |
| Root:Debian:13 | debian | rootio-libraw |
< 0.21.4-2.root.io.2 < 0.21.4-2.root.io.3 Fix: upgrade to 0.21.4-2.root.io.2
|
| Ubuntu:16.04:LTS | canonical | ufraw | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | libraw | All versions |
| Ubuntu:18.04:LTS | canonical | darktable | All versions |
| Ubuntu:18.04:LTS | canonical | dcraw | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | digikam | All versions |
| Ubuntu:18.04:LTS | canonical | exactimage | All versions |
| Ubuntu:18.04:LTS | canonical | kodi | All versions |
| Ubuntu:18.04:LTS | canonical | rawtherapee | All versions |
| Ubuntu:18.04:LTS | canonical | ufraw | All versions |
| Ubuntu:20.04:LTS | canonical | libraw | All versions |
| Ubuntu:20.04:LTS | canonical | darktable | All versions |
| Ubuntu:20.04:LTS | canonical | dcraw | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | digikam | All versions |
| Ubuntu:20.04:LTS | canonical | exactimage | All versions |
| Ubuntu:20.04:LTS | canonical | kodi | All versions |
| Ubuntu:20.04:LTS | canonical | rawtherapee | All versions |
| Ubuntu:22.04:LTS | canonical | darktable | All versions |
| Ubuntu:22.04:LTS | canonical | dcraw | All versions |
Showing 50 of 58. Show the rest
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:22.04:LTS | canonical | exactimage | All versions |
| Ubuntu:22.04:LTS | canonical | kodi | All versions |
| Ubuntu:22.04:LTS | canonical | libraw |
< 0.20.2-2ubuntu2.22.04.3 Fix: upgrade to 0.20.2-2ubuntu2.22.04.3
|
| Ubuntu:22.04:LTS | canonical | rawtherapee | All versions |
| Ubuntu:Pro:22.04:LTS | canonical | digikam | All versions |
| Ubuntu:24.04:LTS | canonical | darktable | All versions |
| Ubuntu:24.04:LTS | canonical | dcraw | All versions |
| Root:Debian:13 | debian | libraw |
< 0.21.4-2.root.io.3 Fix: upgrade to 0.21.4-2.root.io.3
|
Original advisory text
An integer overflow vulnerability exists in the deflate_dng_load_raw functionality of LibRaw Commit 8dc68e2. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can p...
An integer overflow vulnerability exists in the deflate_dng_load_raw functionality of LibRaw Commit 8dc68e2. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
References
- https://security-tracker.debian.org/tracker/CVE-2026-20884 Vendor Advisory
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2026-2364 Exploit Third Party Advisory
- https://ubuntu.com/security/CVE-2026-20884 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-20884 Third Party Advisory
- https://talosintelligence.com/vulnerability_reports/TALOS-2026-2364 Third Party Advisory
- https://ubuntu.com/security/notices/USN-8522-1 Vendor Advisory
Severity
9.8
Critical
CVSS 3.1: 8.1 (NVD)
CVSS 3.1: 8.1 (OSV)
Exploitation
EPSS <1%
Type
CWE-190Integer Overflow
Timeline
Published7 Apr 2026
Updated25 Sep 2026
First seen7 Apr 2026
Track software like this
Free during beta